Different types of authentication, such as PKI certificate authentication, may be used for controlling access to organization facilities, computer networks, and/or almost any other secure system. Users desiring access carry personal authentication devices such as contact or contactless smart cards or secure elements of NFC mobile phones, or any device that offers protection of a private key (or similar) corresponding to the authentication. As an example of personal authentication device, FIPS 201 mandates US Federal Agencies to provide their Employees with Personal Identity Verification cards (PIV) for the purpose of controlling access to federal government assets. FIPS 201 compliant PIV cards are equipped with several X.509 PKI certificates for RSA 2048-bit public keys (and other public key certificates, attribute certificates or credentials) and protect the corresponding private keys that are bound to the device. Although PKI key pairs and certificates may be prepared outside the personal authentication device, the private key—and matching public key—may be generated inside the device to ensure its uniqueness and exclusive binding to the device.
A PKI certificate authentication process requires reading the certificate from the personal authentication module, proving ownership of the private key using a challenge response or other key confirmation mechanism, verifying the certificate signature, verifying that the certificate was issued by a trusted issuer, verifying the certificate validity against the expiration date, and determining the revocation status, etc. For X.509 digital certificates, a certificate revocation check may be performed using either a Certificate Revocation List (CRL) or using an OCSP responder, or other method. It is useful to determine the revocation status of a certificate since a revoked certificate may indicate a security breach with respect to the corresponding private key and/or revocation of the privileges/access granted to the certificate holder. For example, if a government employee is issued a PIV card having one or more certificates that expire at a certain date, but the employee leaves his employment prior to that date, it is useful to revoke any certificates or other credentials associated with the PIV card. When the status of a certificate is revoked, the certificate should not be considered valid, and any security process relying on the validity of the certificate should consider the certificate as invalid. Also, a process that determines that a certificate is invalid when the certificate date information is valid and/or any cryptogram associated with the certificate can be verified may infer that the certificate status is revoked.
However, in some cases, determining the revocation status of a particular certificate may be impractical or impossible. For example, in the case of X.509 certificate revocation information, there may be a time delay in connection with propagating revocation information for each and every certificate associated with a user that has changed status and/or associated with an authentication entity that has been compromised. In addition, for some types of authentication mechanisms, there may not be an available or practical revocation mechanism for determining whether the authentication has been revoked. Also, revocation of multiple certificates or other credentials that need to share the same revocation status may be redundant so that multiple revocation status update transactions that are substantially similar need to be executed.
It would be useful to provide a revocation mechanism that can provide timely and accurate revocation status for different types of credentials.